OTInstaller
Sign in

IP address investigation playbook

Verified publisher

Who holds an IP, what it exposes and what runs next to it, without scanning it

intermediateabout ip address5 toolslicence CC-BY-4.0
Contents 3/5
  1. 1 IP investigation playbook
  2. 2 Scope and legal
  3. 3 Who holds the address
  4. 4 What it exposes
  5. 5 Ranges and neighbours
Tools (5)

Tools used in this guide

  • ipwhois Looks up who holds an IP address through RDAP: network, ASN, organisation and contactsot install osintverse-community/ipwhois
  • cdncheck Tells whether an IP or host is behind a CDN, cloud provider or WAF, and which oneot install osintverse-community/cdncheck
  • naabu Lists an IP's open ports passively from Shodan InternetDB, without scanning itot install osintverse-community/naabu
  • shodan-host Shows what Shodan has seen on an IP: open ports, services, banners, vulnerabilities, locationot install osintverse-community/shodan-host
  • mapcidr Expands, counts, splits and aggregates IP ranges in CIDR notationot install osintverse-community/mapcidr

Install them all:

ot guide tools osintverse-community/ip-investigation

Who holds the address

ot run osintverse-community/ipwhois --ip 1.1.1.1

RDAP, the structured successor to WHOIS, returns:

  • The network block (asn_cidr, network.cidr) and its name.
  • The ASN and its description: the organisation that routes the block. AS13335 CLOUDFLARENET is Cloudflare.
  • The registry (ARIN, RIPE, APNIC, LACNIC, AFRINIC) and country.
  • Entities: the holder, administrative and abuse contacts, often with an organisation name and address.

Then check whether the address belongs to an intermediary:

ot run osintverse-community/cdncheck --target 1.1.1.1

If it is a CDN, WAF or cloud provider, the IP tells you about the provider, not the site behind it. Pivot back to the domain instead (historical DNS, certificates); see the domain playbook.

Tip

Hosting providers that sell small VPSs (DigitalOcean, OVH, Hetzner, Vultr and others) are common for both legitimate projects and throwaway infrastructure. The provider alone tells you little; what runs on it does.

Next: what it exposes.

Published 20 Oct 2026. Read it in a terminal: ot guide read osintverse-community/ip-investigation; offline: ot guide get osintverse-community/ip-investigation · Source · Markdown

Esc

Try

↑ ↓ to move↵ to open